Open-source software is widely used in commercial applications. Pair that with the fact that when choosing open-source software for a new problem, developers often use social proof as a cue. These two facts raise concerns that bad actors can game social proof metrics to induce the use of malign software. We study the question using two field experiments. On the largest developer platform, GitHub, we buy 'stars' for a random set of GitHub repositories of new Python packages and estimate their impact on package downloads and broader repository activity. We find no discernible impact on downloads, nor on forks, pull requests, issues, or other measures of developer engagement. In another field experiment, we manipulate the number of human downloads for Python packages. Again, we find no detectable effect on subsequent downloads or on any measure of repository activity.

翻译：开源软件在商业应用中已被广泛采用。结合开发者在解决新问题时常将社交证明作为选择依据这一事实，上述现象引发了人们对恶意行为者可能操纵社交证明指标以诱导恶意软件使用的担忧。我们通过两项实地实验对此问题展开研究。在最大的开发者平台GitHub上，我们为随机选取的新Python包代码库购买"星标"，并评估其对软件包下载量及代码库整体活跃度的影响。实验发现，此举对下载量未产生可观测的影响，对代码库分支、拉取请求、问题提交等开发者参与度指标亦无显著作用。在另一项实地实验中，我们操控了Python软件包的人工下载数量。结果再次表明，这对后续下载量及代码库各项活跃度指标均未产生可检测的影响。